General

  • Target

    6e6e72e1f7ce44f1c2218232202cbc9aa24eb8d14f5dbcbd6d62bf07f9fa6c44N.exe

  • Size

    904KB

  • Sample

    250104-g631ssyncr

  • MD5

    4ecf3fc1c2e3fdeb0bb150a7fb134f30

  • SHA1

    3fe5bd4a5d0e88e731cd803aa65a934c62d3b89a

  • SHA256

    6e6e72e1f7ce44f1c2218232202cbc9aa24eb8d14f5dbcbd6d62bf07f9fa6c44

  • SHA512

    7a84d71b16c66d5ddf08c366d73fe3031c70c37a3d0e8b855ca9746aedea53d3e25873cfaf7573633331e092fa0fced44cf619ade91b4018aa3499f8f4c5ef8d

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5I:gh+ZkldoPK8YaKGI

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      6e6e72e1f7ce44f1c2218232202cbc9aa24eb8d14f5dbcbd6d62bf07f9fa6c44N.exe

    • Size

      904KB

    • MD5

      4ecf3fc1c2e3fdeb0bb150a7fb134f30

    • SHA1

      3fe5bd4a5d0e88e731cd803aa65a934c62d3b89a

    • SHA256

      6e6e72e1f7ce44f1c2218232202cbc9aa24eb8d14f5dbcbd6d62bf07f9fa6c44

    • SHA512

      7a84d71b16c66d5ddf08c366d73fe3031c70c37a3d0e8b855ca9746aedea53d3e25873cfaf7573633331e092fa0fced44cf619ade91b4018aa3499f8f4c5ef8d

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5I:gh+ZkldoPK8YaKGI

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks